1. Field
The present invention relates to the field of data security. More particularly, this invention relates to a scheme for verifying the integrity of downloaded software.
2. General Background
Computers have become a desirable product for both commercial and personal use, in part due to their versatility. While the purchase price of computers has decreased over the last few years, the total cost of computer ownership has remained generally constant. One reason is that computers need require occasional maintenance to repair or replace faulty hardware, reconfigure corrupted software, or perform other tasks. Normally, computer technicians, at a substantial cost, perform these tasks.
Currently, many companies employ one or more on-site computer technicians to install, support and maintain stand-alone computers. In fact, large companies have established Information Technology (IT) departments that feature computer technicians responsible for servicing thousands of stand-alone computers situated in multiple facilities. Thus, a significant portion of the technician""s working time may be spent traveling from one job to another. To reduce overhead costs and improve efficiency, it is desirable to lessen the amount of time spent wasted by computer technicians traveling between jobs or facilities. This may be accomplished by implementing a centralized platform with multiple disk drives from which employees can remotely access information as needed. As a result, the computer technicians can diagnose and service problems with the centralized platform (e.g., drive errors) at one location, and thus, greatly reduce the amount of travel time.
As centralized platforms are adopted by more and more companies, the general architecture of computers may be altered to exclude disk drives, which are the least reliable component of a computer. This computer architecture alteration, however, poses a problem because most computers boot from a local disk drive.
To overcome this problem, a boot procedure of the computer may be modified so that boot software is downloaded over a network. In particular, during its boot sequence, the local platform would access a particular memory location on a disk drive remotely located at the centralized platform and retrieve a boot image from that memory location. The boot image would be downloaded into main memory of the computer and executed during the boot sequence. Unfortunately, there is currently no security scheme to ensure the integrity of the boot image (e.g., check that the software is free from viruses or has not been tampered with before or during download) as well as its authenticity (e.g., check that the boot image originated from its proper source). The present invention provides a scheme that overcomes these security flaws.
The present invention relates to a method for verifying integrity of information. The information is downloaded to a platform operating in a pre-boot operational state. Thereafter, a determination of whether the information is authorized to be executed by the platform is selectively performed.